WordPress XML-RPC (xmlrpc.php) is enabled and reachable
XML-RPC is an older WordPress feature, reachable at /xmlrpc.php, originally built to let external apps and services interact with a WordPress site remotely. This check only runs when WordPress is detected, and looks at whether this endpoint responds publicly. On this site, the XML-RPC endpoint responds and is reachable.
Why this matters
XML-RPC is a well-known attack surface. Its system.multicall method lets an attacker try hundreds of username and password combinations in a single request, making brute-force attacks far faster than trying one login at a time through the normal login page, and its pingback method is separately abused to relay distributed denial-of-service (DDoS) attacks through the site. Almost no modern WordPress site actually needs this feature enabled.
How to fix it
Your developer should disable XML-RPC entirely unless a specific integration genuinely requires it, which is rare. This can be done at the web server level or through a security plugin like Wordfence or iThemes Security. If the site uses Jetpack or the WordPress mobile app, which do rely on XML-RPC, allowlist only the specific methods those tools actually need rather than leaving the whole endpoint open. About 30 minutes.
Turn website findings into an action plan
Create an account to start a Full Audit of your website, with supporting evidence and a prioritised action plan.
Start Full Audit